Kako uspešno vpeljati IPv6 v Windows okolje in preživeti Luka Manojlovic

IPv4 – 4 octetcs == 4*8 = 32 bit address IPv4 vs IPv6 IPv4 – 4 octetcs == 4*8 = 32 bit address 10.22.33.1 – private address 193.77.157.35 - public address Around 4 billion addresses but... Where is China?!  IPv6 – 16 octects == 16x8 = 128 bit address: Two octetcs are devided by : so we have 8 units : 2001:0:5ef5:79fd:38c0:c950:3eb2:62dc = 2001:0000:5ef5:79fd:38c0:c950:3eb2:62dc 2001:0:5ef5:79fd:38::62dc = 2001:0:5ef5:79fd:38:0000:0000:62dc 2001:0:5ef5:79fd:38::62dc = 2001:0:5ef5:79fd:0038::62dc ::1 = 127.0.0.1 fe80::MACtoHEX link local addresses

Subnetting? /32? /48? /64? /64 for everyone! ISPs delegate prefixes to end costumers

No broadcast Link local only multicast ICMPv6 is a MUST for IPv6 to work

Features IPv6 Autoconfiguration IPSec Mobility – active sessions And the most important thing! Huge address space!

IPv6 header VS IPv4 header No header lenght – fixed 40 byte No identification field – Even in IPv4 useless No checksum – It‘s made on higher layers No fragmentation field No options IPv6 header VS IPv4 header No header lenght – fixed 40 byte No identification field – Even in IPv4 useless No checksum – It‘s made on higher layers No fragmentation field No options

Every option is called „Extension header“ Fragmentation // ICMPv6 type 2 – packet too big Source routing IPsec Destination options

Standardised but still sometimes we find strange implementations by various vendors... Attacks on IPv6 Developed over 15 years ago – with security perspective of that time ARP spoofing in IPv4 world == Neighbour discovery spoofing ARP request == neighbour solicitation ARP response = neighnour advertisment Duplicate address mechanisms and DOS Neighbour solicitation? Yes, IP is in use –> Loop = DOS Hostile router advertisments

Man in the middle attacks Router advertisment flood We send our router advertisment + spoofed router advertisment with liftime = 0 Router advertisment flood Windows XXX DOS – cpu 100% - firewall does not help  All routers -> lifetime =0 everything become „link – local“

Man in the middle attacks Router advertisment flood We send our router advertisment + spoofed router advertisment with liftime = 0 Router advertisment flood Windows XXX DOS – cpu 100% - firewall does not help  All routers -> lifetime =0 everything become „link – local“

Stateful autoconfiguration and flags M and O Router sends router advertisment – from this we get gateway In case both flags in router advertisment are set to 0: We have the same scenario as Stateless autoconfiguration – so we get globaly routed IPv6 address but we do not request and aditional info from DHCPv6 server In case that both flags in router advertisment are set to 1 M flag means – from DHCPv6 get stateful IPv6 (public address) O flag means – from DHCPv6 get other options (DNS, NTP...) M = 0 / O = 1 means – from DHCPv6 get other options (DNS) IP will be calculated by client... M = 1 / O = 0 means – from DHCPv6 get IP address but no other configuration – probably useless combination of flags...

Examples Exchange / mail server trick: Set-NetIPInterface –InterfaceIndex <number> -Dhcp Disabled – on all servers that have static IP address Exchange / mail server trick: mail.domain.com (A an AAAA record – so IPv4 & IPv6) mail-v4.domain.com (A record only – IPv4 only)

http://test-ipv6.com/ https://ipv6.he.net/certification/

Izpolnite anketo! Vam je bilo predavanje všeč? Ste se naučili kaj novega? Vaše mnenje nam veliko pomeni! Da bo NT konferenca prihodnje leto še boljša, vas prosimo, da izpolnite anketo o zadovoljstvu, ki jo najdete v svojem NTK spletnem profilu.

5/14/2018 2:55 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.